Someone backdoored arrayref, and merely resolving the dependency was enough

You didn't have to call the crate. You didn't have to run the binary. You ran cargo build, and a build script fetched an architecture-specific payload over a TLS connection that accepted any certificate, then executed it.

The Rust Project confirmed on August 20 that a compromised maintainer account published arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9. Each pulled in a typosquatted dependency named proc-macro1 (the real one is proc-macro2), whose build script did the downloading and executing. All three crates were yanked inside 86 to 107 minutes, which sounds fast until you remember what a build script is. Compile time is execution time. Nothing in those crates had to be invoked. If your CI resolved the dependency graph during that window, the payload ran with whatever your build agent had. Rust Blog

The blast radius is the part that should ruin your morning. arrayref has roughly 245 million all-time downloads and sits underneath blake3, winit, tiny-skia, and large chunks of the Solana and Ethereum toolchains. Most people running it have never heard of it. That's the shape of every modern supply chain incident: the compromised package is four levels down from anything you deliberately chose. Wiz reports overlap with known DPRK campaigns, which puts this in the same bucket as the LiteLLM compromise rather than a bored teenager's proof of concept.

What to actually do, today, not next sprint. Check your Cargo.lock for those three version numbers. Check CI build logs for August 20, roughly 00:00 to 12:00 UTC, since the yank window sat inside that span. Purge build caches from that day rather than trusting them, because the artifact of a poisoned build is not the crate, it's whatever the payload wrote. And if you have any developer machine that ran cargo build on a project touching blake3 that day, treat it as needing investigation, not reassurance.

The bigger thing here is that build scripts are the most underexamined execution surface in modern packaging. npm has postinstall, Python has setup.py, Rust has build.rs, and in every ecosystem the same rule holds: installing a package runs code. We have spent a decade building lockfiles, signatures, and scanning around the contents of packages, and comparatively little around the fact that the packaging step itself is a shell. I don't have a clean fix to offer. Vendoring everything is impractical, and --offline builds only push the problem to whoever populated the cache. The honest position is that the ecosystem's defense right now is that yanks happen in about 90 minutes, and 90 minutes is a lot of CI runs.